AWS Developer in San Diego, United States

Built GuardDuty's threat intelligence ingestion service, an extensible microservice for ingesting various in-house, third-party and open source threat-intelligence feeds for use in finding generation decision logic.

I developed control-plane APIs to define new ingestors when new threat intelligence feeds become available. I also developed configurable ingestion components that allow for initiating ingestion requests with various parameters and authentication options, transforming responses, and dispatching results to different destinations.

I built data-plane APIs to invoke ingestors on a schedule or as a response to some events, such as SNS notifications. I then used the control-plane APIs to define ingestors for various in-house, third-party, and open source threat-intelligence feeds required by GuardDuty.

Led an AppSec review acceleration program within AWS GuardDuty that achieved the following results:

• Reduced the AppSec review process timeline for new features from months to weeks.
• Uncovered and mitigated several weaknesses in the service's security posture.
• Worked with proactive security teams to mitigate very subtle and intricate attack vectors, including resource-level authorization, confused deputy protection, and cross-account access control.

I provided continuous education to the GuardDuty team on authoring effective threat models, securing their infrastructure, and writing secure code. I also continuously educated the AppSec team on the security measures that govern GuardDuty's infrastructure components, AWS account settings, and DevSecOps practices.

Led GuardDuty's GRC program, helping achieve compliances and building solutions and processes for continuous adherence.

I partnered with the GRC team to understand the auditor requirements for different compliances and identify the gaps in GuardDuty's infrastructure and process security that needed to be filled to achieve each compliance. I then led a group of engineers to implement mitigations for the identified gaps.

Within the program, I helped GuardDuty achieve several compliances, including GDPR, SOC 2, Payment Card Industry Data Security Standard (PCI DSS), HIPAA, and Federal Risk and Authorization Management Program (FedRAMP).

I also built solutions and processes to ensure GuardDuty is continuously adhering to all its existing security compliances.

Led the design and implementation of GuardDuty's Operations Platform, an extensible system built in Python and used by on-call rotation engineers to scale critical administrative and operational activities across GuardDuty's 28 commercial and GovCloud production regions.